Secrets mount as files: secret blocks, the claim's secrets, flow-init writes them e2c125610f43

- **Secrets as files (oxygenhub#107).** A job's `secret "name" { mount-path "/run/secrets/…" }` names a secret the hub holds; it comes with the claim and `flow-init` writes it at that path, 0400, on a tmpfs, before the job starts. Never in the environment, the receipt or an artifact (spec §9). `flow run --secret NAME=VALUE` locally.

/// A secret for a job, as the hub supplies it (spec §9): written by the

/// runner at `path` in the sandbox, 0400, on an in-memory mount; never in

/// the environment, the receipt or an artifact.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

pub struct SecretInput {

    pub name: String,

    pub path: String,

    pub value: String,

}

    /// The secrets the job declares (`secret` blocks), as the hub holds

    /// them for the repository (oxygenhub#107).

    #[serde(default, skip_serializing_if = "Vec::is_empty")]

    pub secrets: Vec<SecretInput>,

    // Secrets as [name, mount path] sorted by name; absent when there are none.

    if !j.secrets.is_empty() {

        fields.push((8, Value::Array(j.secrets.iter().map(|s| Value::Array(vec![text(&s.name), text(&s.mount_path)])).collect())));

    }

pub use pipeline::{Job, Mount, MountSource, Network, Pipeline, Problem, Problems, Runtime, Sandbox, Secret, PIPELINE_PATH};

    /// Secrets the job mounts, sorted by name (spec §9 `secret`): the hub

    /// supplies each by name, the runner mounts it as a file.

    #[serde(default, skip_serializing_if = "Vec::is_empty")]

    pub secrets: Vec<Secret>,

}

/// A secret the job reads as a file (spec §9): never in the environment.

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]

pub struct Secret {

    /// Which secret, as the hub names it; unique in the job.

    pub name: String,

    /// A clean absolute path under `/run/secrets/`, unique in the job;

    /// the file is 0400, the job's user's, on an in-memory mount.

    pub mount_path: String,

/// A secret's mount path: under `/run/secrets/`, no `.` or `..`.

pub fn secret_path_ok(p: &str) -> bool {

    p.strip_prefix("/run/secrets/").is_some_and(|rest| !rest.is_empty() && rest.split('/').all(|c| !c.is_empty() && c != "." && c != ".."))

}

/// The most secrets a job may mount.

pub const MAX_SECRETS: usize = 8;

const LATER_JOB: &[&str] = &["attest"];

/// `secret "deploy-token" { mount-path "/run/secrets/token" }` (spec §9.1).

/// The hub is the vault: the secret of that name set for the repository,

/// its organisation or the site. `vault-ref` is not in this slice.

fn parse_secret(ctx: &mut Ctx, node: &KdlNode, job: &mut Job) {

    let Some(name) = ctx.one_string(node) else {

        ctx.err(node.span(), "`secret` takes a name and a block with mount-path");

        return;

    };

    if !ctx.name_ok(node.span(), "secret", &name) {

        return;

    }

    let mut path = None;

    for c in block(ctx, node) {

        ctx.no_children(c);

        match c.name().value() {

            "mount-path" => match ctx.one_string(c) {

                Some(p) if secret_path_ok(&p) => path = Some(p),

                Some(p) => {

                    ctx.err(c.span(), format!("secret mount-path {p:?} must be an absolute path under /run/secrets/, without . or .."))

                }

                None => {}

            },

            "vault-ref" => ctx.err(c.span(), "`vault-ref` is not in M0; the hub supplies the secret of that name"),

            other => ctx.err(c.span(), format!("unknown secret setting `{other}`")),

        }

    }

    let Some(mount_path) = path else {

        ctx.err(node.span(), format!("secret {name:?} needs a mount-path"));

        return;

    };

    if job.secrets.iter().any(|s| s.name == name) {

        ctx.err(node.span(), format!("secret {name:?} is given twice"));

    } else if job.secrets.iter().any(|s| s.mount_path == mount_path) {

        ctx.err(node.span(), format!("two secrets mount at {mount_path:?}"));

    } else if job.secrets.len() == MAX_SECRETS {

        ctx.err(node.span(), format!("a job has at most {MAX_SECRETS} secrets"));

    } else {

        job.secrets.push(Secret { name, mount_path });

    }

}

        secrets: vec![],

        if key != "scope" && key != "depends-on" && key != "mount" && key != "secret" && key != "runs-on" && !seen.insert(key.to_string()) {

            "secret" => parse_secret(ctx, c, &mut job),

    job.secrets.sort_by(|a, b| a.name.cmp(&b.name));

fn secrets_mount_as_files_and_are_part_of_the_job() {

    let plain = Pipeline::parse(&doc("job \"d\" {\n    sandbox \"alpine\"\n    exec \"deploy\"\n}\n")).unwrap();

    let p = Pipeline::parse(&doc(r#"job "d" {

    sandbox "alpine"

    secret "token" {

        mount-path "/run/secrets/token"

    }

    secret "aws" {

        mount-path "/run/secrets/aws/credentials"

    }

    exec "deploy"

}"#))

    .unwrap();

    let d = &p.jobs["d"];

    assert_eq!(

        d.secrets,

        vec![

            Secret { name: "aws".into(), mount_path: "/run/secrets/aws/credentials".into() },

            Secret { name: "token".into(), mount_path: "/run/secrets/token".into() },

        ],

        "sorted by name"

    );

    assert_ne!(p.hash(), plain.hash(), "secrets are part of the job");

    for (bad, why) in [

        ("secret \"t\" {\n    mount-path \"/tmp/t\"\n}", "under /run/secrets/"),

        ("secret \"t\" {\n    mount-path \"/run/secrets/../x\"\n}", "under /run/secrets/"),

        ("secret \"t\" {\n}", "needs a mount-path"),

        ("secret \"t\" {\n    mount-path \"/run/secrets/a\"\n}\nsecret \"t\" {\n    mount-path \"/run/secrets/b\"\n}", "given twice"),

        (

            "secret \"t\" {\n    mount-path \"/run/secrets/a\"\n}\nsecret \"u\" {\n    mount-path \"/run/secrets/a\"\n}",

            "two secrets mount at",

        ),

        ("secret \"t\" {\n    vault-ref \"x\"\n    mount-path \"/run/secrets/a\"\n}", "vault-ref"),

    ] {

        let e = Pipeline::parse(&doc(&format!("job \"d\" {{\n    sandbox \"alpine\"\n    {bad}\n    exec \"deploy\"\n}}\n"))).unwrap_err();

        assert!(e.to_string().contains(why), "{bad}: {e}");

    }

}

#[test]

        secrets: vec![],

    let old = crate::api::Claim {

        state: String::new(),

        bookmark: String::new(),

        run_number: 0,

        env: Default::default(),

        secrets: vec![],

        ..claim

    };

    /// Secrets to write before the job starts (spec §9): each at `path`

    /// under `/run/secrets`, 0400 and the job's user's, on a tmpfs.

    #[serde(default)]

    secrets: Vec<SecretSpec>,

}

#[derive(serde::Deserialize)]

struct SecretSpec {

    path: String,

    value: String,

        }

    }

    // Secrets: an in-memory mount of their own, only the job's user's,

    // each file 0400; the job file they came from is outside the new root.

    if !job.secrets.is_empty() {

        if !std::path::Path::new("/newroot/run").is_dir() {

            return Err("the image has no /run, where secrets are mounted".into());

        }

        let dir = "/newroot/run/secrets";

        std::fs::create_dir_all(dir).map_err(|e| format!("mkdir {dir}: {e}"))?;

        mount("tmpfs", dir, "tmpfs", nosuid | libc::MS_NOEXEC, &format!("size=1m,uid={uid},gid={gid},mode=700"))?;

        for s in &job.secrets {

            let Some(rel) = s.path.strip_prefix("/run/secrets/") else {

                return Err(format!("secret path {:?} is not under /run/secrets/", s.path));

            };

            let full = format!("{dir}/{rel}");

            if let Some(parent) = std::path::Path::new(&full).parent().and_then(|p| p.to_str()) {

                make_dirs_owned(parent, uid, gid)?;

            }

            std::fs::write(&full, s.value.as_bytes()).map_err(|e| format!("write {}: {e}", s.path))?;

            chown(&full, uid, gid)?;

            std::fs::set_permissions(&full, std::os::unix::fs::PermissionsExt::from_mode(0o400))

                .map_err(|e| format!("chmod {}: {e}", s.path))?;

        /// A secret a job's `secret` block names, as the hub would supply

        /// it; mounted as a file, never in the environment

        #[arg(long = "secret", value_name = "NAME=VALUE")]

        secrets: Vec<String>,

        Cmd::Run { jobs, dir, timeout, vars, secrets } => {

            let pairs = |what: &str, list: &[String]| {

                list.iter()

                    .map(|e| {

                        e.split_once('=')

                            .map(|(k, v)| (k.to_string(), v.to_string()))

                            .ok_or_else(|| anyhow::anyhow!("--{what} {e:?}: expected NAME=VALUE"))

                    })

                    .collect::<Result<Vec<_>>>()

            };

            let (vars, secrets) = (pairs("var", &vars)?, pairs("secret", &secrets)?);

            run_local(&home, &dir, &jobs, Duration::from_secs(timeout * 60), &vars, &secrets)

fn run_local(

    home: &Home,

    dir: &Path,

    only: &[String],

    timeout: Duration,

    vars: &[(String, String)],

    secrets: &[(String, String)],

) -> Result<()> {

        // Each secret the job declares must be given, as the hub would.

        let inputs = job

            .secrets

            .iter()

            .map(|s| {

                let value = secrets.iter().find(|(k, _)| *k == s.name).map(|(_, v)| v.clone());

                value

                    .map(|value| flow_core::api::SecretInput { name: s.name.clone(), path: s.mount_path.clone(), value })

                    .ok_or_else(|| anyhow::anyhow!("job {}: secret {:?} is not given; pass --secret {}=VALUE", job.name, s.name, s.name))

            })

            .collect::<Result<Vec<_>>>()?;

        let out = microvm::run(home, sb, job, &inputs, &js.join("workspace.ext4"), &js, timeout, &mut |r: Record| print_record(&r))?;

use flow_core::api::{Record, SecretInput};

#[allow(clippy::too_many_arguments)]

    secrets: &[SecretInput],

    // Secrets ride in the guest's job file, which only flow-init reads,

    // outside the root the job is confined to; it writes each as a file.

    if !secrets.is_empty() {

        spec["secrets"] =

            serde_json::Value::Array(secrets.iter().map(|s| serde_json::json!({ "path": s.path, "value": s.value })).collect());

    }

            secrets: vec![],

            &claim.secrets,

- `publish` and a job's `attest` are recognised and refused with "not in

  M0", so a pipeline written for the full spec fails clearly.

- `secret "token" { mount-path "/run/secrets/token" }` on a job (up to 8)

  names a secret the hub holds for the repository (its own, its

  organisation's or the site's; oxygenhub#107) and where the job reads it:

  a clean path under `/run/secrets/`. The claim carries each as `secrets`

  and `flow-init` writes it there, 0400 and the job's user's, on a tmpfs

  of its own, before the job starts; it is never in the environment, the

  receipt or an artifact (spec §9). Locally, `flow run --secret

  NAME=VALUE` supplies it. `vault-ref` is not in M0: the hub is the vault.